Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- How do I suppress possible typo in web.conf for ES...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I start my Splunk server I see
Possible typo in stanza [settings] in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf, line: 2: disabled_decomposers = addtermgt, addtermlt
Is this a configuration error? How can I suppress this message?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is not a configuration error, rather a setting that has been deprecated in 4.2. In 4.1.5+ one was able to selectively disable decomposers; however in 4.2 decomposition is selectively enabled via the "enable_decomposers" setting.
This message can and should be suppressed (and will be for 4.2.x only compatible builds of ESS):
To suppress, comment (prepend a '#' to) the following line in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf
Was:
disabled_decomposers = addtermgt, addtermlt
Should be:
#disabled_decomposers = addtermgt, addtermlt
Typically we do not advocate changing "default" configuration files; however, since this is a deprecated setting it cannot be overridden as it should not exist in the first place.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is not a configuration error, rather a setting that has been deprecated in 4.2. In 4.1.5+ one was able to selectively disable decomposers; however in 4.2 decomposition is selectively enabled via the "enable_decomposers" setting.
This message can and should be suppressed (and will be for 4.2.x only compatible builds of ESS):
To suppress, comment (prepend a '#' to) the following line in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf
Was:
disabled_decomposers = addtermgt, addtermlt
Should be:
#disabled_decomposers = addtermgt, addtermlt
Typically we do not advocate changing "default" configuration files; however, since this is a deprecated setting it cannot be overridden as it should not exist in the first place.
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
